The Indian government on Friday removed two smartphone applications from app stores following reports that e-rickshaws could be remotely disabled through a Chinese app called BAT-BMS, according to IT secretary S Krishnan.
Speaking on the sidelines of the CII Cybersecurity Summit, Krishnan confirmed that action had been taken after reports emerged that some e-rickshaws could be rendered inoperable through the BAT-BMS application. "That is right...there are a couple of apps, which came to our notice yesterday and both of them have been taken down from the app stores," Krishnan said, according to news agency PTI.
Government action and calls for app store scrutiny
Krishnan stressed that app stores must exercise due diligence before allowing applications on their platforms. He said the government would take up the issue with app stores to ensure potentially harmful apps are not made available. The issue gained widespread attention after videos circulated on social media claiming that some e-rickshaws were being remotely shut down through a feature linked to the BAT-BMS application. Those videos raised concerns over the cybersecurity risks associated with internet-connected vehicle management systems.
The Delhi government has asked its transport department to verify the authenticity of the BAT-BMS application and investigate claims that it can remotely disable e-rickshaws through Bluetooth connectivity. Transport minister Pankaj Singh said officials had been directed to examine the matter after receiving complaints, although no formal written complaint had been submitted.
How the BAT-BMS app allegedly works
Preliminary findings by government officials suggest the application allows users to wirelessly connect to Bluetooth-enabled lithium batteries within a limited range. While the app is designed to monitor battery parameters such as voltage and temperature, officials believe it has been misused to disrupt e-rickshaws. Officials also pointed out that many budget e-rickshaws in India use Chinese-manufactured Battery Management Systems (BMS) with limited security features. These systems often lack password protection or authentication, making it possible for nearby users to connect through Bluetooth and disable the battery's power output.
BAT-BMS was developed by Shenzhen Grenergy Technology in China's Shenzhen province as a legitimate battery management tool. The application enables users to monitor battery health and remotely manage compatible lithium batteries. However, its remote control feature has reportedly been exploited in India by connecting to unsecured battery systems fitted in some electric vehicles. Several viral videos showed users stopping e-rickshaws by switching off the battery's discharge function through the app, sometimes leaving drivers stranded in the middle of the road. Some drivers claimed they had paid strangers to help restart their vehicles after being targeted.
Implications for supply chain cybersecurity
For enterprise technology decision-makers overseeing logistics fleets, this incident highlights the risks of internet-connected vehicle components — particularly in last-mile delivery e-rickshaws that are increasingly adopted for urban freight. The absence of basic authentication in budget BMS units, as noted by officials, creates a vulnerability that could affect fleet operations. The government's swift removal of the apps and its push for app store accountability signal a tightening regulatory stance on IoT device security. Companies integrating Bluetooth-enabled battery systems in their logistics vehicles should review password protection and access controls to prevent similar remote-disruption scenarios.
Sources:
